Privacy Policy
Last Updated: September 27, 2026
BrokerAlign SaaS Inc. (“BrokerAlign”, “we”, “our”, or “us”) is committed to protecting the privacy, confidentiality, and security of mortgage brokerages, their licensed broker personnel, their real estate referral partners, and the mortgage borrower clients whose information is managed through our platform.
1. Scope & Role of BrokerAlign
BrokerAlign provides a multi-tenant business-to-business (B2B) software-as-a-service application that allows licensed mortgage brokerages (“Subscribers” or “Brokers”) to collaborate with real estate referral agents (“Partners”), track mortgage application pipelines, ingest real estate transaction closing documents, and automate post-closing borrower reviews.
Data Controller vs. Data Processor
In the context of the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Canadian provincial privacy laws (such as Alberta PIPA, BC PIPA, and Quebec Law 25), the Subscriber (Mortgage Brokerage) acts as the Data Controller regarding mortgage applicant and client information. BrokerAlign acts as a Data Processor / Service Provider processing client records strictly on the Broker’s behalf.
2. Information We Collect
We collect and process the following categories of information:
A. Brokerage Account & Billing Data
When you register a brokerage account or subscribe to a paid tier (Basic or Premier), we collect your name, business email address, brokerage entity name, phone number, and workspace URL slug. Payment transactions and subscription billing are processed securely through our authentication and payment infrastructure (Clerk / Stripe). We do not store raw credit card numbers on our servers.
B. Realtor Partner Information
When a brokerage invites real estate referral partners, we collect partner names, email addresses, phone numbers, real estate brokerage affiliations, custom referral tokens, and commission payout model assignments.
C. Mortgage Borrower & Lead Data
Submitted by realtors or brokerages through intake links or API endpoints, including:
- Primary borrower, co-borrower, spouse, or guarantor names, emails, and phone numbers.
- Estimated purchase budget, loan request amount, and property transaction details.
- Critical transaction milestones (Condition of Financing “COF” dates, targeted closing dates).
- Audit timeline notes and lifecycle progression across pipeline stages.
D. Live Deal Closing Transaction Documents
Documents ingested through the partner portal for active transactions, including Purchase and Sale Agreements (PSA), MLS Listing sheets, and Municipal Property Tax Statements. All uploaded files are restricted to PDF and PNG formats with strict file size caps (≤ 3MB) and are immediately transmitted with encrypted transport to the brokerage.
3. How We Use Information
We process information strictly for legitimate business and platform operational purposes:
- Pipeline Orchestration & CRM: Tracking mortgage lifecycle stages from submission through pre-approval, live deal condition tracking, and funded closing.
- Multi-Channel Notifications: Delivering automated transactional status notifications, document delivery alerts, and collaborative notes via Resend email and Twilio SMS.
- Automated Google Review Machine: For Premier subscribers, orchestrating post-closing review drip requests to borrowers and verifying published reviews against contact records using SerpApi and fuzzy matching algorithms.
- Commission Multipliers & Payout Calculation: Calculating tiered volume rewards and generating transaction payout statements for referral partners.
4. Tenant Isolation & Security Architecture
We implement comprehensive technical, organizational, and architectural safeguards to protect sensitive mortgage financial records:
Every database record is scoped to an immutable tenant context (tenantId). Cross-tenant queries are blocked at both the server-action session level and via database Row-Level Security (RLS) policies.
All HTTP traffic is secured with TLS 1.3 encryption across Cloudflare’s edge network. Persistent data is hosted on Neon Serverless PostgreSQL with AES-256 volume encryption at rest.
5. Third-Party Sub-Processors
To deliver our cloud platform, BrokerAlign engages reputable third-party infrastructure providers that maintain rigorous industry security certifications (SOC 2, ISO 27001):
| Sub-Processor | Purpose | Data Location |
|---|---|---|
| Clerk | User Authentication, SSO, & Session Management | United States / Global Edge |
| Neon | Managed Serverless PostgreSQL Database | United States (AWS us-east) |
| Cloudflare | Edge Compute (Workers), KV Caching, & Durable Workflows | Global Edge Network |
| Resend | Transactional Email Delivery & Alert Dispatch | United States |
| Twilio | SMS Review Drips & Notifications | United States |
| SerpApi | Google Maps Public Review Verification | United States |
6. Client Consent & CASL Compliance
The Subscriber acknowledges and agrees that it is responsible for obtaining all legally required consents from borrower clients prior to submitting contact information into BrokerAlign or initiating automated review workflows, including compliance with Canada’s Anti-Spam Legislation (CASL) and the US Telephone Consumer Protection Act (TCPA).
Borrowers may opt out of SMS review communications at any time by replying “STOP”, and email notifications include direct broker reply-to channels and unsubscribe mechanisms where applicable.
7. Data Retention & Deletion
We retain brokerage and transaction pipeline records for the duration of the active subscription. Upon cancellation or formal request by an authorized broker admin, brokerage tenant records, borrower contacts, deal statements, and associated logs can be permanently purged or exported in accordance with regulatory record-keeping requirements.
8. Your Rights & Privacy Inquiries
Under PIPEDA and applicable privacy statutes, individuals have the right to access, verify, and request correction or deletion of their personal information.
If you have questions regarding this Privacy Policy or wish to exercise data rights, please contact our Privacy Office:
Email: privacy@brokeralign.com
Mailing Address: BrokerAlign SaaS Inc., Attn: Privacy Officer, Halifax, Nova Scotia, Canada